Markus Koschany pushed to branch master at Debian Java Maintainers / jackson-databind
Commits: 74a5cd89 by Markus Koschany at 2019-06-21T22:28:08Z Fix Debian bug #930750. CVE-2019-12814, CVE-2019-12384 - - - - - 7417a2d0 by Markus Koschany at 2019-06-21T22:30:17Z Update changelog - - - - - 4 changed files: - debian/changelog - + debian/patches/CVE-2019-12384.patch - + debian/patches/CVE-2019-12814.patch - debian/patches/series Changes: ===================================== debian/changelog ===================================== @@ -1,3 +1,16 @@ +jackson-databind (2.9.8-3) unstable; urgency=medium + + * Team upload. + * Fix CVE-2019-12814 and CVE-2019-12384: + More Polymorphic Typing issues were discovered in jackson-databind. When + Default Typing is enabled (either globally or for a specific property) for + an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x or + logback-core jar in the classpath, an attacker can send a specifically + crafted JSON message that allows them to read arbitrary local files on the + server. (Closes: #930750) + + -- Markus Koschany <[email protected]> Sat, 22 Jun 2019 00:28:48 +0200 + jackson-databind (2.9.8-2) unstable; urgency=medium * Team upload. ===================================== debian/patches/CVE-2019-12384.patch ===================================== @@ -0,0 +1,24 @@ +From: Markus Koschany <[email protected]> +Date: Sat, 22 Jun 2019 00:00:02 +0200 +Subject: CVE-2019-12384 + +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750 +Origin: https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be234 +--- + .../com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +index a17cdf5..3dbb16e 100644 +--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java ++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +@@ -83,6 +83,9 @@ public class SubTypeValidator + // [databind#2326] (2.9.9): one more 3rd party gadget + s.add("com.mysql.cj.jdbc.admin.MiniAdmin"); + ++ // [databind#2334] (2.9.9.1): logback-core ++ s.add("ch.qos.logback.core.db.DriverManagerConnectionSource"); ++ + DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s); + } + ===================================== debian/patches/CVE-2019-12814.patch ===================================== @@ -0,0 +1,29 @@ +From: Markus Koschany <[email protected]> +Date: Sat, 22 Jun 2019 00:26:32 +0200 +Subject: CVE-2019-12814 + +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750 +Origin: https://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5 +--- + .../fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +index 3dbb16e..72db61d 100644 +--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java ++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +@@ -83,9 +83,13 @@ public class SubTypeValidator + // [databind#2326] (2.9.9): one more 3rd party gadget + s.add("com.mysql.cj.jdbc.admin.MiniAdmin"); + +- // [databind#2334] (2.9.9.1): logback-core ++ // [databind#2334]: logback-core + s.add("ch.qos.logback.core.db.DriverManagerConnectionSource"); + ++ // [databind#2341]: jdom/jdom2 ++ s.add("org.jdom.transform.XSLTransformer"); ++ s.add("org.jdom2.transform.XSLTransformer"); ++ + DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s); + } + ===================================== debian/patches/series ===================================== @@ -1 +1,3 @@ CVE-2019-12086.patch +CVE-2019-12384.patch +CVE-2019-12814.patch View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/compare/190432473e29eae4813e5578dc1cd3161e93a69c...7417a2d03c304d74834bf6e70206e8be9855cf30 -- View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/compare/190432473e29eae4813e5578dc1cd3161e93a69c...7417a2d03c304d74834bf6e70206e8be9855cf30 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ pkg-java-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-commits
